4f9c7110bad63fc02534de5579f00462fd41a871039b6a855ebe9a7be930cb37 | Triage™

Login
Reports

Overview

overview

9

Static

static

1

fbo.vbs

windows10-ltsc_2021-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
fbo.vbs
Size 2KB
Sample261002-2ha1bsxtc1
SHA256 4f9c7110bad63fc02534de5579f00462fd41a871039b6a855ebe9a7be930cb37
MD5 9b536a953484e102a237fcf6c3481214
SHA1 c40b830a7b26a4a9c028f0026e54c877c9ab06b8
SHA512 a5263dddbca4498be9b2d857d3738a40a0202dde1e2e6c5aa0af514636aa17cb7070b6ec5a6de3b0fc3ed968c2bc6efdc4d6c04d509387057377bac2ea6d9c24
TLSH
T18651850BD51C80728432B469CC27ED2BCE78E2839265F570B8807889765FAF595A388F
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan

Static task

static1

Behavioral task

behavioral1

Sample

fbo.vbs

Resource

win10ltsc2021-20260911-en

windows10-ltsc_2021-x64

21 signatures

150 seconds

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan

Malware Config

Targets

- Target
  fbo.vbs
- Size 2KB
- SHA256 4f9c7110bad63fc02534de5579f00462fd41a871039b6a855ebe9a7be930cb37
- MD5 9b536a953484e102a237fcf6c3481214
- SHA1 c40b830a7b26a4a9c028f0026e54c877c9ab06b8
- SHA512 a5263dddbca4498be9b2d857d3738a40a0202dde1e2e6c5aa0af514636aa17cb7070b6ec5a6de3b0fc3ed968c2bc6efdc4d6c04d509387057377bac2ea6d9c24
- TLSH
  T18651850BD51C80728432B469CC27ED2BCE78E2839265F570B8807889765FAF595A388F
- MD5 SHA1 SHA512 TLSH
Score

9^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables service(s)
  defense_evasion execution
- Checks whether UAC is enabled
  defense_evasion trojan
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Visual Basic

Windows Command Shell

System Services

Service Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Service Stop

Tasks

static1

behavioral1

defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan

© 2018-2026

Terms | Privacy